Skip to content

Change the JSON schema for the security_rule Kibana asset#1066

Merged
rw-access merged 2 commits intoelastic:mainfrom
rw-access:fleet-pkg-change-schema
Mar 30, 2021
Merged

Change the JSON schema for the security_rule Kibana asset#1066
rw-access merged 2 commits intoelastic:mainfrom
rw-access:fleet-pkg-change-schema

Conversation

@rw-access
Copy link
Copy Markdown
Contributor

Issues

Realized in elastic/integrations#797 and some EPM observations that this isn't structured like other Kibana assets. EPM expects Kibana assets to look like this:

{
  "id": "Whatever the object ID string is, not necessarily enforced as UUID",

  // optional references whatever these are
  "references": null || [],

  // optional info that we don't need
  "migrationVersion": null || {}, 

  // this is where the data is ultimately stored
  "attributes": { ... },

  // type of asset that matches the folder
  "type": "security_rule";
}

We don't have to make attributes internally consistent with other saved objects, but we might want to.

We can still write our own installer in EPM anyway. See the reference on AssetInstallers to see how index patterns are installed separately from other assets.

Summary

References:

@rw-access rw-access requested a review from brokensound77 March 25, 2021 22:44
Comment thread detection_rules/packaging.py
Copy link
Copy Markdown
Contributor

@brokensound77 brokensound77 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just the one requested change, then LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants